1aca4b27a6dd8d8a153e671b88c39af706be77a385db64c7a3836070e37ccefb

General

Target

NA_NA_1d15b474b21da2exeexe_JC.exe
Size

310KB
MD5

1d15b474b21da2353fe6d7ecb81e5e24
SHA1

0b6db2effca1c72d0e126d2c3b495a18c87c3831
SHA256

1aca4b27a6dd8d8a153e671b88c39af706be77a385db64c7a3836070e37ccefb
SHA512

26f4ff1cb0fc7931f2bec42a6106a3d3f0bbc3583ee33d1af0d0ecba34c7d63b7980292c663b2be0ed67856bc693f59cb293ac03cc08a0b14cdeef42085a2cbf
SSDEEP

6144:M2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDRe5v0k2+O:M2TFafJiHCWBWPMjVWrXfNk2Z

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2316	wlogon32.exe
2472	wlogon32.exe

Loads dropped DLL 4 IoCs

pid	Process
1492	NA_NA_1d15b474b21da2exeexe_JC.exe
1492	NA_NA_1d15b474b21da2exeexe_JC.exe
1492	NA_NA_1d15b474b21da2exeexe_JC.exe
2316	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell\open\command	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\ = "haldriver"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\wlogon32.exe\" /START \"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\open	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell\runas	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\ = "Application"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\DefaultIcon	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\DefaultIcon	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell\runas\command	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\DefaultIcon\ = "%1"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\runas	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell\open	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\runas\command	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\wlogon32.exe\" /START \"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\DefaultIcon\ = "%1"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\open\command	NA_NA_1d15b474b21da2exeexe_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2316	wlogon32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2316	1492	NA_NA_1d15b474b21da2exeexe_JC.exe	28
PID 1492 wrote to memory of 2316	1492	NA_NA_1d15b474b21da2exeexe_JC.exe	28
PID 1492 wrote to memory of 2316	1492	NA_NA_1d15b474b21da2exeexe_JC.exe	28
PID 1492 wrote to memory of 2316	1492	NA_NA_1d15b474b21da2exeexe_JC.exe	28
PID 2316 wrote to memory of 2472	2316	wlogon32.exe	29
PID 2316 wrote to memory of 2472	2316	wlogon32.exe	29
PID 2316 wrote to memory of 2472	2316	wlogon32.exe	29
PID 2316 wrote to memory of 2472	2316	wlogon32.exe	29

C:\Users\Admin\AppData\Local\Temp\NA_NA_1d15b474b21da2exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_1d15b474b21da2exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
310KB

MD5
a91f235d4b63cdc62d50e67b80f397bd

SHA1
6234383b61ff2b6fc28a4f05068f05676d4d166d

SHA256
b31d0053470f9cc57695432596e5d9cc86f7ddda00e3e17ae5f02193fdb567ad

SHA512
33a5d7421cba3bed5d67b81814b7ce57dbed344133144ba94eec309597c0e0f5e2597261163b801158b7e2b20461c3bcc42ac01d7011439861dfff0cf7f8325e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
310KB

MD5
a91f235d4b63cdc62d50e67b80f397bd

SHA1
6234383b61ff2b6fc28a4f05068f05676d4d166d

SHA256
b31d0053470f9cc57695432596e5d9cc86f7ddda00e3e17ae5f02193fdb567ad

SHA512
33a5d7421cba3bed5d67b81814b7ce57dbed344133144ba94eec309597c0e0f5e2597261163b801158b7e2b20461c3bcc42ac01d7011439861dfff0cf7f8325e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
310KB

MD5
a91f235d4b63cdc62d50e67b80f397bd

SHA1
6234383b61ff2b6fc28a4f05068f05676d4d166d

SHA256
b31d0053470f9cc57695432596e5d9cc86f7ddda00e3e17ae5f02193fdb567ad

SHA512
33a5d7421cba3bed5d67b81814b7ce57dbed344133144ba94eec309597c0e0f5e2597261163b801158b7e2b20461c3bcc42ac01d7011439861dfff0cf7f8325e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
310KB

MD5
a91f235d4b63cdc62d50e67b80f397bd

SHA1
6234383b61ff2b6fc28a4f05068f05676d4d166d

SHA256
b31d0053470f9cc57695432596e5d9cc86f7ddda00e3e17ae5f02193fdb567ad

SHA512
33a5d7421cba3bed5d67b81814b7ce57dbed344133144ba94eec309597c0e0f5e2597261163b801158b7e2b20461c3bcc42ac01d7011439861dfff0cf7f8325e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
310KB

MD5
a91f235d4b63cdc62d50e67b80f397bd

SHA1
6234383b61ff2b6fc28a4f05068f05676d4d166d

SHA256
b31d0053470f9cc57695432596e5d9cc86f7ddda00e3e17ae5f02193fdb567ad

SHA512
33a5d7421cba3bed5d67b81814b7ce57dbed344133144ba94eec309597c0e0f5e2597261163b801158b7e2b20461c3bcc42ac01d7011439861dfff0cf7f8325e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
310KB

MD5
a91f235d4b63cdc62d50e67b80f397bd

SHA1
6234383b61ff2b6fc28a4f05068f05676d4d166d

SHA256
b31d0053470f9cc57695432596e5d9cc86f7ddda00e3e17ae5f02193fdb567ad

SHA512
33a5d7421cba3bed5d67b81814b7ce57dbed344133144ba94eec309597c0e0f5e2597261163b801158b7e2b20461c3bcc42ac01d7011439861dfff0cf7f8325e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
310KB

MD5
a91f235d4b63cdc62d50e67b80f397bd

SHA1
6234383b61ff2b6fc28a4f05068f05676d4d166d

SHA256
b31d0053470f9cc57695432596e5d9cc86f7ddda00e3e17ae5f02193fdb567ad

SHA512
33a5d7421cba3bed5d67b81814b7ce57dbed344133144ba94eec309597c0e0f5e2597261163b801158b7e2b20461c3bcc42ac01d7011439861dfff0cf7f8325e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
310KB

MD5
a91f235d4b63cdc62d50e67b80f397bd

SHA1
6234383b61ff2b6fc28a4f05068f05676d4d166d

SHA256
b31d0053470f9cc57695432596e5d9cc86f7ddda00e3e17ae5f02193fdb567ad

SHA512
33a5d7421cba3bed5d67b81814b7ce57dbed344133144ba94eec309597c0e0f5e2597261163b801158b7e2b20461c3bcc42ac01d7011439861dfff0cf7f8325e

Download Submit

Analysis

Sharing